What’s Vulnerable › Vulnerabilities

CVE-2026-111608: Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}

• Severity: medium (CVSS 4.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-16 · updated 2026-10-23
• Weakness: CWE-639

Description

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.

Affected products

• jeequan jeepay: through 3.2.9

References

• https://github.com/jeequan/jeepay/blob/V3.2.9/jeepay-merchant/src/main/java/com/jeequan/jeepay/mch/ctrl/division/MchDivisionReceiverController.java#L250-L259
• https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authz
• https://www.vulncheck.com/advisories/jeepay-through-3.2.9-idor-via-delete-api-divisionreceivers-recordid
• https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authz

Get alerted when CVE-2026-111608 or the next vulnerability affects your stack